- cypherpunks-legacy - lists.cpunks.org

java security concerns
by cmcmanis＠scndprsn.Eng.Sun.COM 17 Dec '03

17 Dec '03

Perry pointed out the standard set of concerns that anyone should have with Java. About the only thing I'd care to dispute at the moment is that Java is a "large complicated" application. It is in fact less than 20K lines of C code. And while it is true that applications of even this size are difficult to prove safe, there has been an effort to break that problem up into components such that each "layer" can be proven safe and where that layer is used that safety carries over. Let me give you an example: There are three "parts" of the Java system: o Java Bytecode o Java Runtime o Java Virtual Machine. At a "meta" level there is the Java Language and the compiler that converts it into byte codes however for the purposes of a security discussion those are irrelevant since the browser in this case receives byte codes and the compiler at the other end is presumed suspect. So one way to approach this analysis is to look first at the bytecodes. One of the things you will discover is that Java is *not* a general purpose language. It lacks crucial features such as introspection and anonymous memory access. So you might ask "How can anyone write anything useful in it then?" and that is a fair question. The answer is that it does have one loophole and that loophole is the 'native' keyword on a method description. Basically, if you need a general purpose feature (like object inspection) you can get it with a native method. "So I write a native method to delete your files, what does that buy me?" you might ask. Well Java is also a _late binding_ language. Thus the binding of external method references (which native methods are by definition one) can be identified at bind/link time (which always occurs on the client) and optionally rejected. The next level of inspection is all of the classes that, through one of their methods, actually call a native method. Those can be analyzed closely and there are relatively few of them (about 28). The final level of inspection is the virtual machine interpreter. Its operation as a giant switch statement can be inspected for valid code design. It isn't all that large and a team of three can inspect it in under a week. If the layers work, the system works. We encourage any questions on security or identifying any "holes" to be sent to java(a)java.sun.com for our immediate attention. --Chuck However, Java is also late

6 6

Re: Patents etc
by Jay Campbell 17 Dec '03

17 Dec '03

>IMHO What's needed is a) a good way of measuring usage and b) a realistic >attitude on the part of patent holders as to the value of their patents. > >A good example of how not to do it is the current mess that governs the >music indistry (which very similar problems with copying and incorporation >of material [sampling] all be it in a context of copyright rather than >patents). > >Ted Nelson did a lot of work on this for xanadu and his ideas on >transcopyright are worth exploring further. One interesting (but maybe off-topic) facet of client-side applets (a la Java) is the fact that publishers can define proprietary protocols and file formats, and change them as often as they want, giving a sort of minimal protection against casual duplication and re-publishing. With a bit more work, the formats could make true transclusions efficient and easy to apply, and help increase the amount of serious/commercial information available to the public. This is nothing new, I suppose... Java (from a user point of view) isn't that much different than IntelligentPad, which from what I understand was the client system the Xanadu people were working with recently. -- Jay Campbell - Regional Operations Manager -=-=-=-=-=-=- Sense Networking (Santa Cruz Node) edge(a)got.net "Shoot the Fruit Loop" "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Coming Out Party!
by Lile Elam 17 Dec '03

17 Dec '03

Coming Out Costume Party!! @ Bryant's Bend Our wonderful house at Bryant's Bend in Palo Alto, is celebrating (our new housemate) Joyce Fortune's tenth anniversary of coming out as a lesbian. She has since become bi and celebrates bi'ness with the rest of us here at our veggie co-op. Join us in the wonderful celebrations, gaming and frolic. Come in costume as butch or fem (lingerie is most desired). All uncostumed guests will be bounced by our tall african-american femmi bouncer (Go Frankie!). The particulars: When: Saturday Night (October 14, 1995) Time: 7:00 to late Where: 130 Bryant St. Palo Alto CA What to bring: Yourselves, a costume, gay music in cd or tape cassette medium, and any erotic foods and drinks you might desire... We will be providing the atmosphere and some non-alcoholic drinks and munchies.... Directions: From 101: Take the University Exit that heads West. Follow University Street until you reach Bryant St. Make a right onto Bryant St. and follow it to the end. We are the last house on the left hand side and are on the corner of Bryant St. and Palo Alto Way. It's a big tan house with brown trimmings.

1 0

LOG_rea
by John Young 17 Dec '03

17 Dec '03

10-10-95. NYPaper: "Deleted, but Not Gone or Forgotten." Files produced by Microsoft Office Windows applications, including Word, Excel, Powerpoint and Access, often incorporate chunks of data previously deleted from the disk on which the files were saved. Microsoft said the problem was solved in earlier versions of Microsoft Word but that it has recurred in the new version for Windows 95. Third-party programmers report another security lapse. Word offers optional password protection by encryption. The encryption, however, does not extend to "objects" within the file. "Chip Maker Introduces a Chip for Super Use and for Modems." One of the most closely watched Silicon Valley start-up companies plans on Tuesday to disclose details of an ambitious computer chip that it hopes will one day be used in everything from cable modems to supercomputers. Microunity Systems Engineering Inc. said its chips would be able to process information 10 times faster than today's personal computer microprocessors. The chip will consist of 10.5 million transistors and will process data at a gigahertz, or a billion operations a second. It is designed so that it can process information in parallel and will be capable of issuing up to four 128-bit-wide instructions simultaneously. 2: LOG_rea (10 kb)

1 0

Re: Java idea
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:54 AM 10/10/95 -0400, Mike Fletcher <fletch(a)ain.bls.com> wrote: > >Well, security bugs aside (and I've got the sun4.1.3_u1 and Win32 ns2b >distributions :) has anyone given any thought to using Java to do some >sort of Chinese Lottery attack. I was re-reading App. Crypto. last >night and it could be feasable. If you could get your key cruncher >thread loaded into a good many browsers to run when idle . . . . How >many estimated copies of NS are there? Anyone want to do the math? :) Yeah, this was discussed; mix it in with a cool screen saver "We're busy hacking Microsoft!" bouncing around the screen and you could probably get a lot of people to try it, assuming of course that it can run in offline mode conveniently, which I'm not sure Netscape can yet (downloading the software, copying mozock/nullsock as winsock, and restarting Netscape doesn't strike me as convenient, which means it's also not an off-line mail/news reader yet.) The negative part is that Java Bytecode interpretation is about 10x slower than native code; you'd have to get people to download native libraries for their platform to do the grunt work. #--- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Political influence [was: Re: A Disservice to Mr. Bell]
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Mon Nov 18 20:54:31 1996 > > ....The only mainstream party to have been in > any measure influenced by libertarian ideas is the Republicans ... I suppose that's why Clinton called himself a "libertarian" when it comes to gay rights. (Calling yourself something and actually *being* that something are, of course, different things.) Phill, you need to listen more and talk less about libertarian politics, I first heard about various wild-sounding now "mainstream" ideas when talking with Libertarians. These ideas are now promoted by members of both parties, especially during the election campaign season. For one thing, we were probably the first party to have a policy against government restrictions on the peaceful use of cryptography. JMR Regards, Jim Ray Please note new 2000bit PGPkey & new address <jmr(a)shopmiami.com> This key will be valid through election day 2000. PGP id.A7D63DA9 98 1F 39 BA 93 86 B4 F5 57 52 64 0E DA BA 2C 71 DNRC Minister of Encryption Advocacy -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMpETWzUhsGSn1j2pAQGYQgfMCQSQsEEjekyjOaQTptq3ZGmh4eTbPwdT Ow6LGMOzNTBaONJlypERAm7S00NAf9/ri6liFL2xR/A51t47PPIg48WO4xYHbB2S UefMasDZ2q+jT1s9ukUgHL1EgXCJVggAsaN1mSphYlNgVrRoT0zga59MB3ynFVsH hM4NVJEPCv8waE9WohSLUm6Mp2fvA1zLtGmHdf6fR/R38Yw5aVOTA3ha/hV/zPmH MQIsN+WV16f4KXAL/0V56y1mnuPJ0TumUJwJNc/lNxhiSdlI9t5l3ywe7Aw1D1xo TQO4ARkBSN8+/C/g6R9wfEZ+YoAN42NzNpdcATmCgXhwYg== =hhPT -----END PGP SIGNATURE-----

2 1

Spiderspace
by tcmay＠got.net 17 Dec '03

17 Dec '03

I've been thinking a lot about the problems and opportunities that are coming up as more and more "spiders" (Web searchers, crawlers) are indexing directories and files on systems they can find. For the sake of this post, the files and whatnot these spiders and super-spiders can hit constitute a universe I'll call "spiderspace," as it semi-euphoniously matches cyberspace and cypherspace. Two things caused me to think more intensely abou this: 1. At the Saturday Cypherpunks physical meeting, Marianne Mueller (I think) was telling me about an experience where an old letter she'd written to someone showed up in an Alta Vista search. A personal letter, that is. How this happened was that the letter to her friend was buried several subdirectories deep in a directory he made accessible to the outside world. Presto, Alta Vista found it, indexed it, and made it keyword-searchable! (Humans are pretty bad at doing such meticulous file prep work, but all-seeing spiders are very good at seeing everything.) 2. Someone on the Cyberia-l list, Mike Godwin in fact, asked if anyone had a particular post he'd written last summer, a post he'd neglected to save but that he needed. I had not kept that post, according to my own archives, but I decided to see what Alta Vista might turn up. (The Cyberia-l list is not officially archived, and I believe archives of it are discouraged by the list owner, for various reasons especially worrisome to lawyers and law professors!) Sure enough, a search of "Cyberia-l" in Alta Vista showed all sorts of hits, including what appeared to be several _private archives_ of parts of the traffic. (By "private" I mean in the sense that they were someone's personal archives, and not necessarily complete or even semi-officially sanctioned.) And a search of "Cyberia-l AND Godwin AND parental AND Ferber" (some of the keywords in the post he knew he was looking for) produced two hits, most probably of the post he was seeking. (They were on a Kent Law School archive site that, I believe, is no longer accessible to the outside...the Alta Vista spiders must have gotten to it and indexed it before the site was made less accessible...just a thought.) This fits with the point made above, that increasing numbers of odd things--letters, love letters, resumes, job applications, even things like PGP passwords!--will likely show up by accident in spiderspace. I've started to look for things like PGP files laying around buried in subdirectories. I can imagine attacks based on this. Declan McCullagh, on the Cyberia-l list, followed up to my post on this topic by noting that things will really get interesting when the internal file systems of many sites are made searchable, such as with the Andrew File System (AFS) at CMU and elsewhere. Apparently most users make their directories accessible to others. Implications for Cypherpunks? First, an alert for you to be very careful about what you make accessible to the outside world. It's no longer just a matter of people taking the time to rummage through your subdirectories, it's now trivial to find things with the new Web search engines. Second, what is out there in spiderspace is incredibly useful for building dossiers, for compiling correlations, and for doing competitive analyses. Third, more and more kinds of files are going into spiderspace. This may include files compiled by others, such as files containing Web accesses! (All it takes is for someone to keep a record of site accesses, subscriptions, etc., and then put record in a searchable place: it then becomes trivial to search on a name and find out interesting things.) Fourth...left to your imagination. --Tim May We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Public Awarreness of Security
by Martin Diehl 17 Dec '03

17 Dec '03

On October 11, 1995, John Markoff of the NYTimes writes: "Newly publicized weaknesses in the basic structure of the Internet [snip] .. advantage of the fault-finding talents of the Berkeley researchers and other like-minded experts, the company announced a contest today called Netscape Bugs Bounty [snip]" On October 11, 1995, Joan E. Rigdon of the Wall Street Journal writes: "The software industry is starting to sweep the bugs out of the closet [snip] ... Netscape is trying to systematically tap the intelligence of the hackers instead of randomly waiting for them to find mistakes. [snip]" Both of these stories bring out not only the flaws in the Internet and software to use the Internet, but also the work going on both at the software developers as well as that by groups such as ours that are active in identifying the risks. Congratulations to the Cypherpunks Martin G. Diehl

1 0

Source code
by David Colston 17 Dec '03

17 Dec '03

In case any one is interested, I have the source code for a non-RSA public key system. I wrote it in Microsoft PDS 7.1, which is a version of quick basic. It does 1024 bit keys and I can out run PGP in Basic<G>. If anyone out there is a semi-mathematical type, I will also furnish a paper on the subject. Since this is non-RSA and I'm sure everyone reading this is in the U.S., I don't think I'm involation of ITAR<G>. Uncle Dave

1 0

Re: Standard Headers for Anonymous Remailers
by Eli Brandt 17 Dec '03

17 Dec '03

> From: gtoal(a)an-teallach.com (Graham Toal) > Actually it wasn't the content of the articles that narked me, it was > that I actually wanted to *reply* to the authors. However the subjects > were way too off-topic to be worth responding to in public, which is > the only option the anonymous remailers allows. Though it's a bit clunky to use, the present remailers do support return addressses. I will admit that I haven't seen anybody supply one. Eli ebrandt(a)jarthur.claremont.edu

1 0